The Islamic State of Iraq and the Levant (ISIL) has become the preeminent terror group among U.S.-based extremists according to an assessment authored by the Department of Homeland Security and more than a dozen state and local fusion centers. Individuals determined to fight “overseas in a Muslim-majority country” or conduct attacks domestically will be “more likely to derive inspiration from ISIL than [al-Qaeda] or any of its affiliates” as long as ISIL can maintain its “current level of perceived legitimacy and relevancy.” This assessment of ISIL’s increasing popularity among domestic extremists is the focus of a ten page Field Analysis Report obtained by Public Intelligence titled Assessing ISIL’s Influence and Perceived Legitimacy in the Homeland: A State and Local Perspective. Drawing on suspicious activity reports from around the country as well as intelligence reporting from DHS and the Bureau of Prisons, the report finds that ISIL’s military successes in Iraq and Syria along with the group’s self-proclaimed re-establishment of the caliphate have captured the attention of violent extremists likely to buy in to its “violent extremist counterculture.”

While this may mean that more “lone offender” attacks against U.S. targets are on the way, an assessment from the DHS Office of Intelligence and Analysis sees more sophisticated plots on the horizon. Focusing on a plot disrupted in January 2015 by Belgian authorities in which “a large group of terrorists possibly operating under ISIL direction” were found to have stockpiled explosive precursors and sophisticated weaponry, DHS concludes that the group may have “developed the capability to launch more complex operations in the West.” The assessment titled Future ISIL Operations in West Could Resemble Disrupted Belgian Plot was released to law enforcement last month and was also obtained by Public Intelligence.

An Increase in Suspicious Activity

In the second half of 2014, the volume of ISIL-related suspicious activity reports that were received by state, local and federal authorities “increased sharply,” indicating a trend that “signifies a penetration of ISIL’s messaging into the Homeland.” This increase coincides with the group’s recent military successes including “rapid territorial gains” and the “self-declared re-establishment of a caliphate.” ISIL has also rapidly expanded its English-language messaging to include armies of social media accounts, elaborate and gruesome videos as well as an English-language magazine that highlights life inside of the Islamic State, including “government services” such as “banking, health care and education.” Previous assessments from DHS have noted the “savvy” use of media by ISIL, though the Field Analysis Report studying the group’s legitimacy focuses on the activity this messaging has inspired domestically. According to the report, graffiti, symbols, paraphernalia and other ISIL-related imagery has been reported to law enforcement throughout the U.S. Personnel at Marine Corps Base Quantico reportedly discovered leaflets with an ISIL banner discussing “coming from Mexico on a train.” Small ISIL flags were found on the windshields of vehicles in a residential neighborhood in Falls Church, Virginia. ISIL stickers have also been reported on highway signs and other public structures in Arizona, Nevada and Texas.

Though suspicious activity reports related to ISIL have increased significantly, many of the reports are likely not a legitimate indicator of ISIL activity. In preparing their Field Analysis Report, fusion center personnel reviewed a number of incidents that resulted in suspicious activity reports being filed into the national Information Sharing Environment and found that half of those were based on anonymous tips “that were likely not credible.” These reports often described “aspirational threats of violence against family or friends, where ISIL-affiliation appeared to be used only as a means to intimidate the victim(s).” The other incidents reviewed, “most of which . . . were also likely not credible” related to public threats against political targets. These include threats made against the President as well as public calls for the assassination of Twitter employees following the company’s suspension of accounts associated with ISIL in 2014. Over one-third of the reports were related to “social media postings” including the dissemination of “official ISIL messaging.”

ISIL’s Legitimacy Surpasses al-Qaeda

Whether the increase in suspicious activity reporting related to ISIL is an accurate indicator of the group’s increasing operational presence or simply an artifact of the group’s increasing notoriety, the Field Analysis Report argues it is a reflection of the group’s increasing legitimacy. Through its bloody tactics, the group wins converts by asserting their defense of “Muslims against enemy attacks” as well as the defense of the “self-proclaimed re-establishment of the caliphate.” Citing surveillance of inmate communications conducted by the Bureau of Prisons, the Field Analysis Report lists a number of incidents where U.S. involvement in the Middle East was listed as a justification of ISIL’s tactics. In multiple conversations with family members, one inmate reportedly stated his belief that the group needed to “finish Shiites and other disbelievers.” Criminal indictments of U.S. persons inspired by ISIL to either travel overseas or conduct attacks domestically also indicate a “general desire to fight overseas, defend Muslims against aggressors and join like-minded violent extremists.”

Office of Intelligence and Analysis Field Analysis Report

9 pages

For Official Use Only

Law Enforcement Sensitive

May 5, 2015

(U//FOUO) Scope: This Field Analysis Report (FAR) is designed to support awareness and inform enforcement and collection operations of federal, state, and local partners involved in homeland security and counterterrorism efforts. Some of the activities described in the FAR may be constitutionally protected activities and should be supported by additional facts to justify increased suspicion. The totality of relevant circumstances should be evaluated when considering any law enforcement response or action. Our assessment of the level of the Islamic State of Iraq and the Levant’s (ISIL) name recognition since its declaration of a caliphate in June 2014 is based on a review of suspicious activity reporting (SAR) across the United States between 1 January and 30 December 2014, criminal complaints of US persons charged with supporting or seeking to support ISIL, Bureau of Prisons (BOP) intelligence reporting, and DHS I&A open source reporting to assess the influence of ISIL’s messaging campaign within the United States and ISIL’s perceived legitimacy among homegrown violent extremists (HVEs).

(U) Key Findings

(U//LES) We assess an increased volume of ISIL-related SARs between June 2014 and January 2015 signifies the penetration and recognition of its brand because much of this reporting centered on ISIL symbols, imagery, and support for the group voiced on social media.

(U//FOUO) We judge––based on the body of SAR, criminal complaints, BOP reports, and open source reporting consulted throughout this FAR (see Scope and Source Summary Statements)––that ISIL’s messaging is resonating with US-based violent extremists due to its championing of a multifaceted vision of a caliphate that prioritizes a wide array of justifications and obligations for support, especially compared to other terrorist groups with whom it competes for support, like al-Qa‘ida (AQ) and its affiliates. ISIL’s messaging is amplified through a sophisticated use of social media tailored to a global audience.

(U//LES) A high volume of SAR reporting—of varying degrees of potential threats—associated with ISIL will likely persist as long as ISIL sustains its messaging campaign and perceived military and governance successes, specifically so long as it is perceived to successfully defend its self-declared caliphate.

(U//FOUO) We assess ISIL’s name recognition is built in large measure on its military successes and rapid territorial gains in Syria and Iraq in 2014. The allure for potential HVEs also rests with ISIL’s carefully constructed image, based on the perceived legitimacy of its self-proclaimed re-establishment of the caliphate, governance efforts according to their interpretation of Islamic law, and ability to project power through continued expansion—all conveyed via a highly organized messaging effort. The prevalence of media coverage surrounding ISIL’s exploits challenges our ability to isolate and assess how central a role ISIL-directed messaging, amplified by individuals who share that messaging online though their individual social media platforms, plays in influencing demonstrations of ISIL support in the United States.

(U//FOUO) ISIL espouses a violent extremist counterculture and vision focused on the expansion of its self-proclaimed caliphate. This approach is at odds with the model traditionally espoused by AQ, which focuses on driving perceived Western aggressors from Muslim-majority countries through terrorist attacks in the West, before conquest of a state or establishment of a caliphate. The ISIL narrative includes a positive vision—in the eyes of its members—of an alternative political system that is to be established now, as opposed to at some point in the distant future.

(U//FOUO) As a consequence, a broader and more diverse pool of individuals in the United States, including females, may identify strongly with aspects of ISIL’s narrative—including governance under a particular vision of Islamic law, the re-establishment of the caliphate, the purported obligation upon Muslims to emigrate once it is formed, and the defense of Sunni Muslims against the Syrian regime’s persecution. These elements of ISIL’s narrative do not resemble goals long prioritized by AQ via its English-language messaging. We judge ISIL’s self-purported success as a functioning and viable state responding to US-led coalition attacks helps legitimize—to some individuals—its use of terrorist tactics to defend itself against perceived Western aggression.

(U//LES) The volume of ISIL-related SARs increased sharply in the second half of 2014, according to queries of state, local, and federal holdings nationally. Chronologically, this uptick corresponds with ISIL’s military successes, self-declared re-establishment of a caliphate, and increased English-language messaging—along with increased media coverage of these exploits. Any single incident of suspicious activity, in isolation, may constitute constitutionally protected activity and does not necessarily indicate an intent to mobilize to violence or provide material support to ISIL. Nevertheless, as a body of reporting showing a trend, we judge the increase in SARs signifies a penetration of ISIL’s messaging into the Homeland.

(U//LES) Several incidents related to ISIL graffiti, symbols, or ISIL-related paraphernalia—including clothing, patches, and flags––were reported to law enforcement agencies. Additional examples of graffiti, in Arabic and English, stickers with ISIL emblems, and similar imagery have been reported in the United States. A group was arrested in France in November 2014 for selling ISIL paraphernalia to US-based individuals and other customers, according to open source reporting.